Security woes hit Spotify music service

It's a popular, up-and-coming web service, so the time seems right for the bad guys to keep Spotify grounded by hitting it with a security breach.

Just days after signing up its millionth user, Spotify admitted that its security had been bypassed, with user information such as email, birth date, gender, post code and billing receipt details potentially open to hackers. Payment data such as credit card numbers are not held by the company, so were not at risk, it said.

The music service was alerted last week that its protocols had been compromised, allowing rapid testing of passwords. "The information was exposed due to a bug that we discovered and fixed on December 19th, 2008. Until last week we were unaware that anyone had had access to our protocols to exploit it," Spotify's chief technology officer Andreas Ehn wrote in the service's official blog.

Spotify was quick to clarify that the only users at risk were those with a weak password who signed up before 19 December last year and had not changed their password since that date. Any user fitting that description was sent a warning email and advised to change their password.

The data that was compromised were password hashes. Until that bug was fixed, "it was possible to access the password hashes of individual users had you reverse-engineered the Spotify protocol and knew the username."

"We are really sorry about this and hope you accept our apologies. We're doubling our efforts to keep the systems secure in order to prevent anything like this from happening again," Ehns wrote.

The Spotify attack follows security breaches at Facebook and Twitter.